Dotclear vulnerabilities

Multiple incomplete blacklist vulnerabilities in Dotclear before version 2.8.2 allow remote authenticated users with permissions to manage their own media items and entries/comments to execute arbitrary PHP code by uploading a file with a .pht, .phps, or .phtml extension.

In Dotclear before version 2.10.3, there is an unrestricted file upload vulnerability in the fileUnzip->unzip method that allows remote authenticated users with permissions to manage media items to execute arbitrary code by uploading a ZIP file containing a file with a crafted extension.

In Dotclear versions up to 2.10.4, there is an unrestricted file upload vulnerability in the 'Install or upgrade manually' module that allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with a zip extension.

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by inc/public/lib.urlhandlers.php or plugins/pages/_public.php.

Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload process by crafting a PHP shell with a command execution form to gain system access through the uploaded file.